Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2019-0220

Published: 11/06/2019 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Http Server

Vulnerability Summary

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server

opensuse leap 42.3

opensuse leap 15.0

debian debian linux 8.0

debian debian linux 9.0

fedoraproject fedora 28

fedoraproject fedora 29

fedoraproject fedora 30

canonical ubuntu linux 16.04

canonical ubuntu linux 14.04

canonical ubuntu linux 18.04

canonical ubuntu linux 18.10

Vendor Advisories

Ubuntu Security Notice: apache2 vulnerabilities
Several security issues were fixed in the Apache HTTP Server ...
Red Hat: Low: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP1 Security Update
Synopsis Low: Red Hat JBoss Core Services Apache HTTP Server 2437 SP1 Security Update Type/Severity Security Advisory: Low Topic Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2437 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise L ...
Red Hat: Moderate: httpd:2.4 security and bug fix update
Synopsis Moderate: httpd:24 security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for the httpd:24 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring S ...
Red Hat: Moderate: httpd24-httpd security, bug fix, and enhancement update
Synopsis Moderate: httpd24-httpd security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for httpd24, httpd24-httpd, and httpd24-nghttp2 is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of ...
Red Hat: Low: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP1 Security Update
Synopsis Low: Red Hat JBoss Core Services Apache HTTP Server 2437 SP1 Security Update Type/Severity Security Advisory: Low Topic Red Hat JBoss Core Services Pack Apache Server 2437 Service Pack 1 zip release for RHEL 6, RHEL 7 and Microsoft Windows is availableRed Hat Product Security has rated this up ...
Red Hat: Moderate: httpd security and bug fix update
Synopsis Moderate: httpd security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for httpd is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base s ...
Debian CVElist Bug Report Logs: apache2: CVE-2018-17189: mod_http2, DoS via slow, unneeded request bodies
Debian Bug report logs - #920302 apache2: CVE-2018-17189: mod_http2, DoS via slow, unneeded request bodies Package: src:apache2; Maintainer for src:apache2 is Debian Apache Maintainers <debian-apache@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 23 Jan 2019 20:33:05 UTC Severity: ...
Debian CVElist Bug Report Logs: apache2: CVE-2018-17199: mod_session_cookie does not respect expiry time
Debian Bug report logs - #920303 apache2: CVE-2018-17199: mod_session_cookie does not respect expiry time Package: src:apache2; Maintainer for src:apache2 is Debian Apache Maintainers <debian-apache@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 23 Jan 2019 20:36:02 UTC Severity: ...
Debian Security Advisories: DSA-4422-1 apache2 -- security update
Several vulnerabilities have been found in the Apache HTTP server CVE-2018-17189 Gal Goldshtein of F5 Networks discovered a denial of service vulnerability in mod_http2 By sending malformed requests, the http/2 stream for that request unnecessarily occupied a server thread cleaning up incoming data, resulting in denial of service ...
Amazon Linux AMI: ALAS-2019-1189
In Apache HTTP Server with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard (CVE-2019-0211) A vulnerability was found in ...
Amazon Linux 2: ALAS2-2019-1189
In Apache HTTP Server with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard (CVE-2019-0211) mod_http2: read-after-free on ...
Arch Linux Issues:
Severity Unknown Remote Unknown Type Unknown Description AVG-946 apache 2438-1 2439-1 Medium Testing ...
Hitachi Security Advisories: Vulnerability in Cosminexus HTTP Server and Hitachi Web Server
A vulnerability (CVE-2019-0220) exists in Cosminexus HTTP Server and Hitachi Web Server Affected products and versions are listed below Please upgrade your version to the appropriate version ...
Brocade Security Advisories: Access Denied
Menu Log in ...

Github Repositories

https://github.com/Vanessapan001/pentest-1-Introduction-to-Pentesting-and-OSINT

this topic includes Reconnaissance and planning, Google Dorking, certificate transparency, shodan & recon-ng

Introduction-to-Pentesting-and-OSINT Objectives of this article: Understand the role of a pentester in assessing a business's security Collect domain information using OSINT techniques and tools like Google dorking, Shodan, and certificate transparency Use Shodan and Recon-ng to discover domain server information PLEASE DO NOT practice these techniques against compute

References

CWE-706https://www.debian.org/security/2019/dsa-4422https://usn.ubuntu.com/3937-1/https://support.f5.com/csp/article/K44591505https://seclists.org/bugtraq/2019/Apr/5https://lists.debian.org/debian-lts-announce/2019/04/msg00008.htmlhttps://httpd.apache.org/security/vulnerabilities_24.htmlhttp://www.securityfocus.com/bid/107670http://www.openwall.com/lists/oss-security/2019/04/02/6http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.htmlhttps://security.netapp.com/advisory/ntap-20190625-0007/https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttps://access.redhat.com/errata/RHSA-2019:2343https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_ushttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://access.redhat.com/errata/RHSA-2019:3436https://access.redhat.com/errata/RHSA-2019:4126https://access.redhat.com/errata/RHSA-2020:0250https://access.redhat.com/errata/RHSA-2020:0251https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r31f46d1f16ffcafa68058596b21f6eaf6d352290e522690a1cdccdd7%40%3Cbugs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://usn.ubuntu.com/3937-1/https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-30924CVE-2024-3400overflowCVE-2024-23528CVE-2024-21338CVE-2024-3818CVE-2024-23535NULL pointer dereferenceelevation of privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook